Penetration testing for MSPs

Yes. Many managed IT providers want to offer security testing but cannot justify hiring and keeping specialist testers. An AI security testing engineer gives you a way to run testing for clients as part of your service, while you keep the client relationship.

Nebula is an AI security testing engineer, built by BreachLine Labs in London. See How Nebula works. What your clients receive is on What comes as standard.

Where a client's contract, insurer or tender requires a CREST-accredited report, see AI pentest vs CREST pentest: which do you need?

MSPs already know which clients have web apps, client portals, APIs or cloud estates exposed to the internet. Those are the systems Nebula is built to test.

A practical approach:

• Start with clients who are already asking. Supplier questionnaires, insurance renewals and tenders often ask about security testing.
• Test after the changes you make. When you migrate a client to new cloud services or launch a portal, test it before and after.
• Retest your own fixes. When you remediate a finding for a client, ask Nebula to retest so you have evidence the fix works.
• Brief by email. Each AI staff member has its own email address, so your engineers can brief Nebula the way they brief each other.

There is also regulation to watch. If you operate in the UK, the UK government's Cyber Security and Resilience (Network and Information Systems) Bill would bring medium and large managed service providers that meet the definition of a "relevant managed service provider" into the scope of the NIS Regulations 2018, regulated by the Information Commission. According to the gov.uk factsheet, these providers would need appropriate and proportionate measures to manage risks to the systems they rely on, and would have to report significant incidents. The Bill is still progressing through Parliament, and these duties will be brought into force through secondary legislation after Royal Assent. Check the latest position on gov.uk and take your own advice on whether it applies to you.

If you operate in the UK, testing a system without written authorisation is a criminal offence under the Computer Misuse Act 1990. BreachLine requires written authorisation for the scope before any testing starts, and that requirement cannot be waived.

For an MSP, that means treating each client as a separate engagement:

1. Agree the scope with the client. List the domains, applications, APIs or cloud accounts in scope, and anything that must not be touched.
2. Get written authorisation from the system owner. If a system is hosted by a third party, check whether their permission is needed too.
3. Provide test accounts where authenticated testing is needed, so Nebula can check features behind sign-in.
4. Set the task in the workspace within that scope. Nebula's tools are limited by the task, approved scope and available connections.
5. Review findings, fix and retest.

Keeping scopes and authorisations separate per client protects you, your client and the testing record.

BreachLine's published plans are monthly, with credits included. See How do credits work?

For several clients, the Team or Business plans give more credits and seats for your engineers. How you price testing to your own clients is your decision. Some MSPs bundle testing into a security tier; others offer it as a project. Either way, agree with each client what will be tested and how often, so credit use stays predictable.

We do not have a published MSP partner programme yet. If you are an MSP or managed IT provider, and want to talk about offering testing to your clients, get in touch. We will talk through your client base and which plan fits. Tell us roughly how many clients you support and what they run, and we can show Nebula working on your own assets in a 30-minute demo.

See Do you need Cyber Essentials as well as a pentest?